Качество, безопасность, конфиденциальность и соответствие нормативным требованиям

EcoVadis Purpose is to “Guide all companies toward a sustainable world”, and EcoVadis four core purpose objectives:

1. Deliver independent, trusted, and actionable sustainability ratings and insights through methodology excellence.
2. Enable the greatest number of companies to continuously improve their business practices and contribute to creating a regenerative and equitable economy.
3. Cultivate an inclusive learning environment for our people, providing meaningful work and empowering future generations of sustainability practitioners.
4. Способствовать коллективным действиям в рамках нашей экосистемы для ускорения перехода к устойчивому миру.

Компания EcoVadis разработала систему менеджмента качества (СМК), которая сертифицирована по стандарту ISO 9001. Мы активно стремимся к постоянному улучшению качества через систему управления процессами, которая позволяет каждому сотруднику эффективно работать в безопасной и стимулирующей рабочей среде. В основе этой системы лежит наша самостоятельно разработанная ИТ-платформа, на которой выполняются все рабочие процессы. Для совершенствования процессов мы регулярно прибегаем к помощи специализированных органов и отделов, таких как наш комитет по методологии.

• Программы обучения
  сотрудников
  • В рамках введения в должность все новые сотрудники осваивают программы обучения по обеспечению качества данных и информационной безопасности. В программах предусмотрены контрольные вопросы и проходные баллы. Все сотрудники также проходят обязательное ежегодное повышение квалификации с последующими контрольными опросами.
• Корректирующие и предупреждающие действия
  • Continuous improvement with the identification of improvement areas to eliminate non-conformities or prevent reoccurence. One example being the use of the Quality tool for non conformities detection and feedback provision through the evaluation process.
• Процесс управления инцидентами
  • С помощью платформы управления инцидентами мы регистрируем и обрабатываем жалобы клиентов и поставщиков, а также внутренние проблемы. Все инциденты регулярно рассматриваются заинтересованными сторонами и решаются в установленные сроки.
• Внутренний аудит
  • The Internal Audit Program is set over a period of 3 years where Information Security audits are conducted twice per year and all internal processes undergo a Quality audit at least once per year. Audit results are reviewed and discussed during our biannual Management Review.

EcoVadis provides holistic sustainability ratings service of companies, delivered via a global cloud-based SaaS platform hosted in Microsoft Azure – one of the most trusted cloud hosting providers.

We are committed to provide the highest level of Information Security and to continuously improve in order to protect all stakeholders’ data in an evolving landscape of information security threats. For this reason, EcoVadis has established an Information Security management system (ISMS) which undergoes regular independent third-party audits for ISO/IEC 27001 compliance (please see the certificate and statement of applicability).

Our ISMS enables us to systematically operate and maintain information security in our business processes and services and to determine and apply the necessary security measures based on our risk evaluation.

Our Information Security Policies are regularly reviewed and updated  to confirm that the content remains timely and accurate and it still correlates to compliance requirements industry best practices applicable to us.

We have a dedicated, in-house team responsible for developing, maintaining and monitoring of information security. Priorities are established worldwide within our organization to provide a single, coherent vision around the protection of our assets.

At EcoVadis, we realize that raising awareness about threats to information security is an ongoing process. Our employees are regularly trained in IT and Information Security best practices and alignment with EcoVadis IT Security standards, and the way to operate IT systems in a secure manner.

Мы поддерживаем точную и актуальную инвентаризацию активов, связанных с предоставляемыми услугами, и классифицируем информацию с точки зрения юридических требований, ценности, критичности и чувствительности к несанкционированному раскрытию или изменению.

Azure is a multi tenant service, there is a logical separation in place which isolates data between customers.

Access rights and privileges to EcoVadis information systems and network domains must be allocated based on the specific requirement of a user’s job function (RBAC), we follow need-to-know and least privilege principles.

Our clients manage their access independently: the client platform administrator can create and deactivate users as needed. The platform can be accessed using username & password. We also provide a  Single sign-on (SSO) authentication capability for requesting companies and you can contact your usual commercial contact for more information.

Data is encrypted (at rest and in transit) using industry-approved encryption algorithms and methods. We follow industry best practices to securely store and manage secrets within our environment.

Our platforms are hosted in Microsoft Azure datacenters located in the EU. According to a shared responsibility model in the cloud, physical security controls fall under the obligation of Microsoft. More information about the controls can be found here.

We make sure that changes to the organization, business processes, information processing facilities and systems that affect information security are controlled. We have implemented monitoring and detection technology and processes to identify, prevent, and manage malware vulnerabilities, or other security-relevant events within our infrastructure. Best security hardening practices are followed, such as CIS (Center for Internet Security) for operating systems and Microsoft Azure hardening guides for cloud services.

Network access to internal services and servers is restricted and secured. We have a Web Application Firewall in place (please see details here) and use Azure Front Door – a modern cloud content delivery network (CDN) service that delivers high performance, scalability, and secure user experiences.

Мы используем отраслевые стандарты для обеспечения безопасности наших систем и жизненного цикла разработки программного обеспечения (SDLC). Гарантируется, что новые разработки проходят надлежащие процессы тестирования и проверки перед запуском в эксплуатацию. Среды разработки, тестирования и эксплуатации разделены.

We have established information security requirements for suppliers that may access, process, store, communicate, or provide IT infrastructure components for the organization’s information. We also conduct cybersecurity and data security risk assessments of suppliers with access to our network, data or other sensitive information.

We continuously work on providing highly secure services to our clients, but incidents are an inevitable reality that has to be carefully managed. At EcoVadis, appropriate measures are implemented to ensure a consistent and effective approach to the management of information security incidents. Our security incident management process covers, but it is not limited to: client notification, maintaining written procedures to be followed in the event of a security incident and using all reasonable efforts to mitigate its consequences.

We are committed to make sure that information processing facilities are implemented with redundancy sufficient to meet availability requirements (please see our platform’s uptime report where service performance, availability and real user experience are constantly monitored).

Backups are performed and tested regularly in accordance with the defined backup policy.

Чтобы получить более полное представление о соблюдении требований информационной безопасности, мы проводим несколько видов аудита и технических проверок:

– Infrastructure Reviews

– Code Reviews (SAST: Static Application Security Testing, SCA: Software Composition Analysis)

– Web application penetration testing (this is performed at least once a year by an external company)

– External Posture Management

– Internal Risk Assessments

– ISO 27001 certification audits

We have filled in several standard questionnaires. The result can be shared on demand

• Cybervadis
• CyberGRX
• SecurityScorecard:

• Whistic

Microsoft Azure certifications are available in the Service Trust Portal.

Notice required by licensors of any open source libraries or components related to any of the applicable services. EcoVadis solution sometimes includes, or depends upon, open source libraries. To comply with the license requirements of open source libraries and licensee’s attribution moral right, below there is a list of open-source software used to build our products – please be informed that all information here is provided “as is” and might be subject to a change by the licensee:

* The application is linked dynamically to LGPL license, consequently, the proprietary code can be kept proprietary.

EcoVadis believes that the GDPR is an important step to strengthen and harmonize data protection of EU citizens’ personal data. As a data controller for the provided Rating services Ecovadis is committed to comply with GDPR and as far as they are applicable to international data protection regulations and to put in place the best practices.

Ecovadis uses the ISO 27001 standard, for which we are certified, as a framework and integrates personal data protection aspects in its management system. We use the complementary ISO 27701 framework to meet GDPR requirements. Our data protection practices and compliance are confirmed by a third party audit.

Для обработки данных, осуществляемой за пределами ЕС, мы заключили стандартные договорные положения (СДП) с нашими дочерними компаниями.

We always carefully select our providers (processors) and we require the conclusion of Data Protection Agreements with processors and Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCR) in case of processing outside of the EEA region to be able to work for us. We always aim to choose subscriptions with providers  to have data hosted on servers based in Europe. We use the following processors to provide our service:

We rely on the recommendations on additional measures issued by the French Data protection authority CNIL and the European Data Protection Board concerning the possibilities of transferring data to the United States based on SCCs (or BCR).

Узнайте больше в нашем заявлении о конфиденциальности данных.

EcoVadis is committed to be in compliance with all applicable laws and regulations applicable to an operator of general purpose online services, including without limitation, the laws of France and the United States of America, in terms of its own operating locations for the services.

Ограничения по месту назначения

Принимая во внимание общие деловые риски, продукты и услуги Ecovadis недоступны для экспорта, повторного экспорта, передачи и/или использования в следующих странах/регионах (могут быть изменены без уведомления):

• the regions of Crimea, Donetsk, and Luhansk
• Куба
• Иран
• Северная Корея
• Сирия

Кроме того, к транзакциям с определенными местами назначения, представляющими повышенный риск экспортного контроля или санкций, или связанными с ними, предъявляются повышенные требования комплексной юридической оценки.

Ограничения для конечных пользователей

Продукты и услуги EcoVadis недоступны юридическим и физическим лицам, операции с которыми запрещены в соответствии с действующими законами об экспортном контроле и санкциях, включая лиц, перечисленных в любых применимых списках сторон, находящихся под санкциями (например, санкционный список Европейского союза, списки лиц особой категории США, OFAC, санкции Совета Безопасности ООН, списки, составляемые странами, в которых компания EcoVadis ведет деятельность).

Ограничения конечного использования

Услуги EcoVadis не должны использоваться в целях, запрещенных применимым экспортным законодательством, включая, помимо прочих, разработку, проектирование, производство или изготовление ядерного, химического или биологического оружия массового поражения.

Данная веб-страница предназначена только для общих информационных целей и не заменяет юридическую консультацию.